LIVE FEED

A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident. A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident.

Vulnerability

Philips lists Zenition 70 and VitalSky under Terrapin SSH flaw CVE-2023-48795

MedDevice Cyber Staff · Apr 8 · 2 min read · Via Philips product security advisories 2024

On April 8, 2024, Philips posted a notice on CVE-2023-48795, the SSH transport protocol flaw known as the Terrapin attack. The listed products are Zenition 70, MsMs, Home+, VitalSky and Smarthopping.

Terrapin lets an attacker in the network path manipulate the initial SSH handshake and downgrade the security of the connection. It needs a man in the middle position, so it is a network hygiene problem first. It also affects many SSH client and server implementations, which is why it lands in device advisories years after the protocol was designed.

Disable the affected cipher modes where the product allows it and patch the SSH library when Philips releases the update.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Apply the Philips update for CVE-2023-48795 on Zenition 70, MsMs, Home+, VitalSky and Smarthopping when available. Until then, limit SSH reachability to management hosts so no attacker sits in the path.

Restrict SSH paths. Allow SSH to the listed products only from known management hosts.
Patch through Philips. Apply the Philips validated SSH update for CVE-2023-48795.
Retire weak modes. Remove the affected cipher and MAC combinations wherever configuration allows.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure.

Required

Remote access

Contributing

Off-the-shelf software

Fix the class in your product

The product can encrypt but does not by default. As the maker, make transport security the default and the only option, refuse to negotiate down to plaintext, and validate the certificate on the device rather than trusting the network.

Encrypt by default. Require TLS on every link and reject an unencrypted fallback.
Validate the peer. Verify or pin the certificate; keep credentials and tokens out of URLs.
Retire the plaintext mode. Remove the legacy cleartext option on a defined timeline rather than carrying it forever.

Mapped EMB3D mitigations

Questions & Answers

What is the Terrapin attack, CVE-2023-48795?

CVE-2023-48795, the Terrapin attack, is an SSH transport protocol flaw that lets an attacker downgrade connection security by manipulating the initial handshake. Philips listed Zenition 70, MsMs, Home+, VitalSky and Smarthopping on April 8, 2024.

Is Philips Zenition 70 affected by Terrapin?

Yes. Philips listed Zenition 70 in its April 8, 2024 notice on CVE-2023-48795, along with MsMs, Home+, VitalSky and Smarthopping.

← Back to Vulnerabilities